JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 102.220.158.247

102.220.158.247 was found in our database!

This IP was reported 16 times. Confidence of Abuse is 60%: ?

60%

ISP	CITY CHANNELS CABLE NETWORK ZAMBIA LIMITED
Usage Type	Fixed Line ISP
ASN	AS328817
Hostname(s)	102-220-158-247.simbafiber.co.zm
Domain Name	simbafiber.co.zm
Country	🇿🇲 Zambia
City	Lusaka, Lusaka Province

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 102.220.158.247

Whois 102.220.158.247

IP Abuse Reports for 102.220.158.247:

This IP address has been reported a total of 16 times from 11 distinct sources. 102.220.158.247 was first reported on March 16th 2026, and the most recent report was 16 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇪🇸 alferez	2026-07-21 08:46:23 (16 hours ago)	xmlrpc.php attack DOS	Hacking Exploited Host Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 08:43:21 (16 hours ago)	(mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co. ... show more (mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co.zm): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 04:43:17.140871 2026] [security2:error] [pid 3393:tid 3433] [client 102.220.158.247:22709] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.220.158.247 (+1 hits since last alert)\|atlasrecordssearch.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "atlasrecordssearch.com"] [uri "/xmlrpc.php"] [unique_id "al8xJeKQ8Utmb2MGI3EHGgAAAEc"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-21 07:41:04 (17 hours ago)	(mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co. ... show more (mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co.zm): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 21 03:40:59.006112 2026] [security2:error] [pid 10044:tid 10066] [client 102.220.158.247:22734] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.220.158.247 (+1 hits since last alert)\|munatseng.org\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "munatseng.org"] [uri "/xmlrpc.php"] [unique_id "al8iivjkOwDCK0SLL4YBygAAABQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 13:23:11 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co. ... show more (mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co.zm): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 09:23:07.440908 2026] [security2:error] [pid 2865523:tid 2865523] [client 102.220.158.247:22630] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.220.158.247 (+1 hits since last alert)\|jacquelineperriam.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "jacquelineperriam.com"] [uri "/xmlrpc.php"] [unique_id "al4hO3EQmmrLoU4GG6RaagAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 ghostwarriors	2026-07-20 12:50:43 (1 day ago)	Webpage scraping	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-20 12:48:52 (1 day ago)	Fail2Ban: WordPress XML-RPC brute-force attack detected.	Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-07-20 07:05:33 (1 day ago)	(mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co. ... show more (mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co.zm): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 03:05:27.109673 2026] [security2:error] [pid 32265:tid 32265] [client 102.220.158.247:22565] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.220.158.247 (+1 hits since last alert)\|truthsabouthealthcare.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "truthsabouthealthcare.com"] [uri "/xmlrpc.php"] [unique_id "al3It8EfKKe0Lmu1uZ7A-QAAAAg"] show less	Brute-Force Bad Web Bot Web App Attack
Anonymous	2026-07-18 09:39:05 (3 days ago)	Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1	Hacking Web App Attack
🇫🇷 SpaceHost-Server	2026-07-17 14:32:43 (4 days ago)	102.220.158.247 - - [17/Jul/2026:16:32:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack/12 ... show more 102.220.158.247 - - [17/Jul/2026:16:32:23 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack/12.0; WordPress/6.2; http://site35899960.com" 102.220.158.247 - - [17/Jul/2026:16:32:33 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "WordPress.com; https://wordpress.com" 102.220.158.247 - - [17/Jul/2026:16:32:43 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack by WordPress.com" show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-07-17 14:19:36 (4 days ago)	(mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co. ... show more (mod_security) mod_security (id:240335) triggered by 102.220.158.247 (102-220-158-247.simbafiber.co.zm): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 10:19:28.950220 2026] [security2:error] [pid 47295:tid 47295] [client 102.220.158.247:22729] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)\|Source 102.220.158.247 (+1 hits since last alert)\|furbabieslivesmatter.com\|F\|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "furbabieslivesmatter.com"] [uri "/xmlrpc.php"] [unique_id "alo58I4Y3BLPCzl2pTu9uwAAAAE"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 SpaceHost-Server	2026-07-17 14:17:19 (4 days ago)	102.220.158.247 - - [17/Jul/2026:16:16:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack/12 ... show more 102.220.158.247 - - [17/Jul/2026:16:16:59 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack/12.5; WordPress/6.4; http://site88795432.com" 102.220.158.247 - - [17/Jul/2026:16:17:07 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "WordPress.com; https://wordpress.com" 102.220.158.247 - - [17/Jul/2026:16:17:18 +0200] "POST /xmlrpc.php HTTP/1.1" 200 430 "-" "Jetpack/12.0; WordPress/6.3; http://site90480118.com" show less	Hacking Web App Attack
🇩🇪 F242	2026-07-17 13:46:41 (4 days ago)	Wordpress soft lock	Web App Attack
🇩🇪 LRob	2026-07-17 11:44:13 (4 days ago)	CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.co ... show more CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc \| req: /xmlrpc.php \| UA: Jetpack by WordPress.com (Jetpack 13.0; WordPress 6.3) show less	Brute-Force Web App Attack
🇺🇸 kosada.com	2026-07-17 08:30:41 (4 days ago)	Web bot: denial-of-service flood	DDoS Attack Bad Web Bot
Anonymous	2026-05-02 02:25:06 (2 months ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host

Showing 1 to 15 of 16 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇹🇭 113.53.115.45

🇷🇺 95.165.140.133

🇫🇷 91.196.152.211

🇺🇸 64.62.197.36

🇳🇱 45.148.10.152

🇵🇪 38.250.148.39

🇳🇱 160.119.71.136

🇧🇷 147.15.15.226

🇺🇸 136.112.207.133

🇺🇸 129.121.114.225

🇵🇰 111.68.107.91

🇫🇷 91.231.89.205

🇳🇱 89.248.173.188

🇵🇱 83.219.248.100

🇺🇸 47.77.180.95

🇧🇷 45.231.153.59

🇷🇴 2.57.121.112

🇩🇪 2a00:19e0:3005:2ff:b902:bb81:d790:d3f6

🇨🇱 201.241.5.120

🇧🇪 198.235.24.172